POS malware remains a huge problem for retailers. Now a new strain — dubbed FastPOS — is changing the credit fraud game by tossing subtle techniques in favor of speedy, smash-and-grab incidents. Here’s a rapid rundown.
Gimme, Gimme, Gimme
Most cybercriminals building or buying POS malware put a high priority on secrecy; the longer their infection goes undetected, the better, since this allows more time to collect and transfer credit card details. To accomplish this aim, POS programs make every effort to obfuscate their location and intent, and only periodically upload stolen credit data to the command-and-control (C&C) server.
FastPOS, meanwhile, takes a different route. According to Softpedia, subtlety is not the malware’s strong point — once it’s up and running, the program grabs as much information as possible and sends it back home.
It starts with a keylogger to grab all keystrokes from any window on affected computers, which transmits relevant data as soon as users press enter. Meanwhile, RAM scrapers with real-time verification features target and take only valid credit card data. Bottom line? This super-speedy stealer isn’t fooling around.
Security firm Trend Micro, which discovered the new strain, said that the malware doesn’t seem to have a particular focus or target industry. But it has appeared across the globe, stealing data at speed and then moving on to the next target.
New Code, New Targets
Also worth noting is a shift in focus. SC Magazine pointed out that FastPOS has avoided complex enterprise networks in favor of smaller, simpler retail systems. It’s not hard to work out the reasoning: The shotgun approach to data theft is quickly noticed by organizations with large IT teams, while smaller companies may not realize what’s going on until it’s too late.
When it comes to infection vectors, FastPOS isn’t straying too far from the beaten path. Common methods include a real-time file sharing service, compromised medical websites and the occasional brute-force VNC connection. Researchers have also discovered several online forums selling the stolen data.
One in particular not only hosts an ad for the malicious code, but also resolves to the same IP as one of the malware’s C&C servers. That suggests that whoever is operating the forum also developed the malware, effectively creating a one-stop shop for both credit details and the means to obtain this data.
POS tools are evolving to meet market demand. Enterprises getting wise to point-of-sale malware tricks? Small businesses are next in line. Criminals not getting enough credit card data to satisfy demand? They opt for speed over subtlety, taking whatever they can and getting out.
It’s not sophisticated or elegant, but it’s worrisome. Speed benefits the bad guys, and right now FastPOS is one step ahead.